Amazon Technologies, Inc.

Todd Jeffrey Green

Gaurav Saxena

Kiran Kumar Chinta

Abhishek Sharma

James Claiborne Moore

Dmytro Bogatov

Yanzhu Ji

Gokul Soundararajan

Ippokratis Pandis

Punit Rajgaria

Murali Brahmadesam

Hemanth Satyanarayana

Sanuj Basu

Matthew Perry Abrams

Gopal Paliwal

Vadim Skipin

Johannes Wust

Techniques for priority-based masking policy selection in a database environment are described. Masking policies are defined and attached to columns of relational data for particular users or roles. The attachment of a masking policy to a column includes a user-specified priority value. When multiple policies could apply to a particular query, the conflict can be easily resolved and understood by use of the priority values, for example, by selecting a candidate policy having a highest priority value.

Priority-based masking policy selection in a database environment

Techniques for dynamic database redaction using protected encryption secret material are described. A masking policy is defined that includes a reference to a secret material stored by a secrets manager service. The masking policy further identifies a pseudonymous redaction function that utilizes a cryptographic function requiring such a secret material. The secrets manager service is configured to grant access to the secret material by an entity of the database service that executes queries, such as a leader node of a cluster. For a particular query, the cluster obtains the secret material from the secrets manager service in a secure manner, uses the secret material for applying the cryptographic function to values for redaction purposes, and deletes any copies of secret material thereafter.

Dynamic database redaction using protected secret material

Methods for replicating transactional tables of a transactional database to an analytical database and maintaining updates to those transactional table representations are disclosed. Snapshots of the transactional tables are provided to the analytical database via a transport mechanism, such as a data storage service or a data streaming service, and stored at the analytical database. Then, checkpoints comprising portions of a change-data-capture log that has recorded transactional changes to the transactional tables of the transactional database are provided to the analytical database via the same or different transport mechanism and used to commit those transactional changes to the snapshot representations. The snapshot representations may be used to respond to incoming analytical queries in order to provide real-time querying results.

Hybrid transactional and analytical processing architecture for optimization of real-time analytical querying

Growing community of inventors

Davis, CA, United States of America

Todd Jeffrey Green